Operation Saffron: First VPN Dismantled in Major Cybercrime Takedown
ID: dd1b3c1d-d4a8-5c25-b5cd-dac28d0d43bc
STIX ID: report--dd1b3c1d-d4a8-5c25-b5cd-dac28d0d43bc
Feed Name: ThreatCluster
Threat Score
On May 19–21, 2026, Operation Saffron—led by France and the Netherlands with support from Europol and Eurojust—dismantled First VPN, a criminal VPN service used by ransomware actors and other cybercriminals; authorities seized 33 servers, took control of domains (1vpns.com/.net/.org), arrested the administrator in Ukraine, identified 506 users across 18 countries, and distributed intelligence to support ongoing investigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.